SentinelBrief
← Alert queue

14.255.187.76

Sensor
hp-use-01
Source
cowrie
Status
triaged
Event time
Received

Verdict

S4successful_intrusionConfidence 97%Escalate: yes

Reasoning

The session shows a successful SSH login to the honeypot using root/password, which constitutes a foothold. Per rubric, any successful login is at least severity 4 and falls under successful_intrusion unless there is evidence of malware delivery or persistence. Retrieved session commands show zero commands and no downloads/uploads, so there is no evidence of post-login recon, payload delivery, or persistence in this session.

Recommended action

Escalate as a confirmed foothold; retain session artifacts, monitor for repeat access from this IP, and correlate with nearby sessions for follow-on activity.

Routing

Primary model
gpt-4o-mini
Final model
gpt-5.4
Escalated to strong model
yes
Prompt version
triage-v4
Input tokens
4,654
Output tokens
277
Cost
$0.006208
Latency
4,639 ms
Verdict at
2026-09-14 09:22:02Z

Tool trace

  1. 0. get_session_commands· 0 ms

    Arguments
    {
  "session_id": "2096f046bc95"
}
    Result
    {
  "commands": [],
  "downloads": [],
  "session_id": "2096f046bc95",
  "command_count": 0,
  "download_count": 0,
  "clipped_commands": 0,
  "commands_truncated": false,
  "downloads_truncated": false
}
Raw session JSON
{
  "events": [
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.session.connect",
      "message": "New connection: 14.255.187.76:57881 (172.18.0.2:2222) [session: 2096f046bc95]",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:41.000115Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.client.version",
      "message": "Remote SSH version: SSH-2.0-PuTTY_Release_0.70",
      "outfile": null,
      "session": "2096f046bc95",
      "version": "SSH-2.0-PuTTY_Release_0.70",
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:41.000389Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "encCS": [
        "aes256-ctr",
        "aes256-cbc",
        "rijndael-cbc@lysator.liu.se",
        "aes192-ctr",
        "aes192-cbc",
        "aes128-ctr",
        "aes128-cbc",
        "chacha20-poly1305@openssh.com",
        "blowfish-ctr",
        "blowfish-cbc",
        "3des-ctr",
        "3des-cbc",
        "arcfour256",
        "arcfour128"
      ],
      "hassh": "0425c279610910d2d9aef3b285e59b86",
      "input": null,
      "macCS": [
        "hmac-sha2-256",
        "hmac-sha1",
        "hmac-sha1-96",
        "hmac-md5",
        "hmac-sha2-256-etm@openssh.com",
        "hmac-sha1-etm@openssh.com",
        "hmac-sha1-96-etm@openssh.com",
        "hmac-md5-etm@openssh.com"
      ],
      "compCS": [
        "none",
        "zlib"
      ],
      "dst_ip": "172.18.0.2",
      "langCS": [
        ""
      ],
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.client.kex",
      "kexAlgs": [
        "curve25519-sha256@libssh.org",
        "ecdh-sha2-nistp256",
        "ecdh-sha2-nistp384",
        "ecdh-sha2-nistp521",
        "diffie-hellman-group-exchange-sha256",
        "diffie-hellman-group-exchange-sha1",
        "diffie-hellman-group14-sha1",
        "rsa2048-sha256",
        "rsa1024-sha1",
        "diffie-hellman-group1-sha1"
      ],
      "keyAlgs": [
        "ssh-ed25519",
        "ecdsa-sha2-nistp256",
        "ecdsa-sha2-nistp384",
        "ecdsa-sha2-nistp521",
        "ssh-rsa",
        "ssh-dss"
      ],
      "message": "SSH client hassh fingerprint: 0425c279610910d2d9aef3b285e59b86",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:41.294922Z",
      "duration_ms": null,
      "hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,chacha20-poly1305@openssh.com,blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128;hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha1-96-etm@openssh.com,hmac-md5-etm@openssh.com;none,zlib"
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.login.success",
      "message": "login attempt [root/password] succeeded",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 2222,
      "password": "password",
      "protocol": "ssh",
      "src_port": 57881,
      "username": "root",
      "timestamp": "2026-09-14T09:21:43.569127Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.request",
      "message": "direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0",
      "orig_ip": "0.0.0.0",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "orig_port": 0,
      "timestamp": "2026-09-14T09:21:58.439330Z",
      "duration_ms": null
    },
    {
      "ja4": "t12d1515h2_8daaf6152771_5563d4852cd1",
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.ja4",
      "message": "JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1515h2_8daaf6152771_5563d4852cd1",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:58.674539Z",
      "duration_ms": null
    },
    {
      "id": 0,
      "url": null,
      "data": "b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\x8f\\x846\\x81\\xc9[\\x96\\xb2\\xcc\\xdf\\xe8\\xa5\\x02]9cJ\\xc1a\\xad\\x92\\xc8U,@\\x9a\\x1a\\x15\\x84\\x1a\\xe5 \\xe4}\\xdf\\xfc\\xc5\\xf4l7\\x85\\xab\\xb6\\x08}\\xd5[\\xa2\\x83\\x9a\\x91\\xa9|\\x03E\\x1d\\xb0\\xee.\\xc6\\xffZ`\\xcc\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xf3\\xad5J]9-\\x16\\xe1\\x1b\\x0e\\x17\\xa7\\xc9\\xfa\\xaf?\\x88\\xa22\\xf5HiS\\xb43\\xbbu\\xae\\x12\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.data",
      "message": "discarded direct-tcp forward request 0 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03\\x06\\x8f\\x846\\x81\\xc9[\\x96\\xb2\\xcc\\xdf\\xe8\\xa5\\x02]9cJ\\xc1a\\xad\\x92\\xc8U,@\\x9a\\x1a\\x15\\x84\\x1a\\xe5 \\xe4}\\xdf\\xfc\\xc5\\xf4l7\\x85\\xab\\xb6\\x08}\\xd5[\\xa2\\x83\\x9a\\x91\\xa9|\\x03E\\x1d\\xb0\\xee.\\xc6\\xffZ`\\xcc\\x00 ::\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x01\\x00\\x01\\x93\\xda\\xda\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08\\x9a\\x9a\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x12\\x00\\x10\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)\\x9a\\x9a\\x00\\x01\\x00\\x00\\x1d\\x00 z\\xf3\\xad5J]9-\\x16\\xe1\\x1b\\x0e\\x17\\xa7\\xc9\\xfa\\xaf?\\x88\\xa22\\xf5HiS\\xb43\\xbbu\\xae\\x12\\x04\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\xca\\xca\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\xaa\\xaa\\x00\\x01\\x00\\x00\\x15\\x00\\xcb\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:58.674865Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.request",
      "message": "direct-tcp connection request to 172.67.133.8:443 from 0.0.0.0:0",
      "orig_ip": "0.0.0.0",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "orig_port": 0,
      "timestamp": "2026-09-14T09:21:59.189278Z",
      "duration_ms": null
    },
    {
      "ja4": "t12d1615h2_46e7e9700bed_cadd4ee51f0b",
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.ja4",
      "message": "JA4 fingerprint for forwarded TLS to 172.67.133.8:443: t12d1615h2_46e7e9700bed_cadd4ee51f0b",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:59.476272Z",
      "duration_ms": null
    },
    {
      "id": 1,
      "url": null,
      "data": "b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ba\\xedTQ\\xc4\\x98\\xb1\\x9c6\\xcdOXe\\x05/\\xcdp\\x8f\\x8af9\\x85\\xbf\\x95Z\\x90DL`/\\xc4 \\xd1\\xf58\\xf4X\\xfb\\xcc\\x00\\xae\\xda\\x02\\xeavY)H}\\x87{\\xce\\xe1T1\\xae\\xf7\\x9d\\xed\\xe6\\x06\\x13\\xe6\\xb1\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\x7f>\\\\G\\xdb%C\\x87\\xb4\\x18v\\xf69\\xfcRX\\xee\\x90\\xf3\\x87\\xa4\\x85\\xf1\\xd9\\x94\\xb3@\\xa4\\xc1\\xb5j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.67.133.8",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.data",
      "message": "discarded direct-tcp forward request 1 to 172.67.133.8:443 with data b'\\x16\\x03\\x01\\x02\\x00\\x01\\x00\\x01\\xfc\\x03\\x03Ba\\xedTQ\\xc4\\x98\\xb1\\x9c6\\xcdOXe\\x05/\\xcdp\\x8f\\x8af9\\x85\\xbf\\x95Z\\x90DL`/\\xc4 \\xd1\\xf58\\xf4X\\xfb\\xcc\\x00\\xae\\xda\\x02\\xeavY)H}\\x87{\\xce\\xe1T1\\xae\\xf7\\x9d\\xed\\xe6\\x06\\x13\\xe6\\xb1\\x00\"\\xda\\xda\\x13\\x01\\x13\\x02\\x13\\x03\\xc0+\\xc0/\\xc0,\\xc00\\xcc\\xa9\\xcc\\xa8\\xc0\\x13\\xc0\\x14\\x00\\x9c\\x00\\x9d\\x00/\\x005\\x00\\n\\x01\\x00\\x01\\x91\\x8a\\x8a\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x14\\x00\\x00\\x11link.deepmedia.vn\\x00\\x17\\x00\\x00\\xff\\x01\\x00\\x01\\x00\\x00\\n\\x00\\n\\x00\\x08JJ\\x00\\x1d\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x00#\\x00\\x00\\x00\\x10\\x00\\x0e\\x00\\x0c\\x02h2\\x08http/1.1\\x00\\x05\\x00\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\r\\x00\\x14\\x00\\x12\\x04\\x03\\x08\\x04\\x04\\x01\\x05\\x03\\x08\\x05\\x05\\x01\\x08\\x06\\x06\\x01\\x02\\x01\\x00\\x12\\x00\\x00\\x003\\x00+\\x00)JJ\\x00\\x01\\x00\\x00\\x1d\\x00 \\xbf\\x7f>\\\\G\\xdb%C\\x87\\xb4\\x18v\\xf69\\xfcRX\\xee\\x90\\xf3\\x87\\xa4\\x85\\xf1\\xd9\\x94\\xb3@\\xa4\\xc1\\xb5j\\x00-\\x00\\x02\\x01\\x01\\x00+\\x00\\x0b\\n\\x8a\\x8a\\x03\\x04\\x03\\x03\\x03\\x02\\x03\\x01\\x00\\x1b\\x00\\x03\\x02\\x00\\x02\\n\\n\\x00\\x01\\x00\\x00\\x15\\x00\\xc7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 443,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:21:59.476551Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "159.65.2.87",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.request",
      "message": "direct-tcp connection request to 159.65.2.87:80 from 0.0.0.0:0",
      "orig_ip": "0.0.0.0",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 80,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "orig_port": 0,
      "timestamp": "2026-09-14T09:22:00.264901Z",
      "duration_ms": null
    },
    {
      "url": null,
      "ja4h": "po11nn10enus_0af5a74ca4c0_000000000000_000000000000",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "159.65.2.87",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.ja4h",
      "message": "JA4H fingerprint for forwarded HTTP to 159.65.2.87:80: po11nn10enus_0af5a74ca4c0_000000000000_000000000000",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 80,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:22:00.742197Z",
      "duration_ms": null
    },
    {
      "id": 2,
      "url": null,
      "data": "b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cWdqV15XMUtLNTAoUUFXVA%3D%3DxtEu7RDq2HV4rdaPeBGN5QPAjc%2BsCa2Tw5WnqTEkfGb7XuIl22xjeVLk%2F8rXMKg4FKHDVmW0wdVC0NjjxG893IzEkJ4DqjuKSuFQfXcO8IcT3cE4GxSswTylqz74gcjXZ9U6C381f%2Ffgtcn7oHsbQ1fxgQvqsGlfDcSkB0PuIP6XP0h3k9SasEtdqGzV4gL1Dk2wMN6KCq7C1E%2BodRR0s1BWouGry3eoDl%2B95xgswsJhaNo82Y8BzUq5eBrx%2BdTxW%2FYdPs6KLkZu6s44BkIl%2BaKcxFAFVGUlEW7VxWJW5topvgVDxYBtvqtLZLJGno0i%2BPsqFHSyNorU7TBncPBUhQ9zFeFk5Z4SjqFJgJfgQZFA7eVGhh0Yekmo1A3kTkP71SRXHuT1Zb%2BVQUcQtsSmgsxw1hMnbr%2BDgaj1UGmd6Auwk20v2WuR%2Fh5ccFx5TDUpBVZmY6fS%2B9xJR5YD32FYxIchnslOOL65D0fmYA500%2FqMtrMf5LpBlxzo2YiGO%2Bz5VB4ZzaD3vFbrjjPM1GbVAoJFJwdn94tvxZX232WprO0DTJyaNutwn89ymFK%2FYjr%2FWEXfoF17daLvjUcTGojLqt6jNZMUt4Np7cSJJR1Hw%2FJ69PxaPfVv1%2BjPBc1b1LA6L8vNqt2nmNBO1Ibxwl1n66pk%2BnX%2BbhbazY%2B7O6ClRCxdQoxXoHB%2BLR6nxxIEaG5qt%2F9en5MYeHH6%2FJZI1giBdfyuE%2FaYSal9K9qtrE%2FYuhcm5FpGMYf0%2F1PmtgLPKK%2FAVfwnSeNlH8oSrEABvTrjDT%2BOUXSW1l%2B75OivqtNPLakRnCT%2FZolQpOWNElxv9Ve2AWm8jRQfxVXy2QA%2FFxE8j%2FaaKdW0tyuHD1914i6vtVYxFCONnC7uKahiDx0wZ%2BqLPEjH4r2joVg71Zi1ixrPlLYA2gcAWs8HwwGerYJi6iwR7LNtfbtBjlthmpNa8nmX1zBFSAJu66ZQDxg57yYnpbezQA0R%2FoZd2ZEVL7ITjd8qc7P0WEyn%2FS9Aj0LwlTVwoBjK%2FG7syRdt5krW6QgOwg%3D%3D'",
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "159.65.2.87",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.direct-tcpip.data",
      "message": "discarded direct-tcp forward request 2 to 159.65.2.87:80 with data b'POST /bot/statistic HTTP/1.1\\r\\nHost: api.9hits.com\\r\\nAccept-Language: en-US\\r\\nAccept-Encoding: gzip, deflate\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nOrigin: http://api.9hits.com\\r\\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/90.0.4430.93 Mobile/18C66 Safari/604.1\\r\\nConnection: keep-alive\\r\\nContent-Length: 1158\\r\\nPragma: no-cache\\r\\nCache-Control: no-cache\\r\\n\\r\\n_=cWdqV15XMUtLNTAoUUFXVA%3D%3DxtEu7RDq2HV4rdaPeBGN5QPAjc%2BsCa2Tw5WnqTEkfGb7XuIl22xjeVLk%2F8rXMKg4FKHDVmW0wdVC0NjjxG893IzEkJ4DqjuKSuFQfXcO8IcT3cE4GxSswTylqz74gcjXZ9U6C381f%2Ffgtcn7oHsbQ1fxgQvqsGlfDcSkB0PuIP6XP0h3k9SasEtdqGzV4gL1Dk2wMN6KCq7C1E%2BodRR0s1BWouGry3eoDl%2B95xgswsJhaNo82Y8BzUq5eBrx%2BdTxW%2FYdPs6KLkZu6s44BkIl%2BaKcxFAFVGUlEW7VxWJW5topvgVDxYBtvqtLZLJGno0i%2BPsqFHSyNorU7TBncPBUhQ9zFeFk5Z4SjqFJgJfgQZFA7eVGhh0Yekmo1A3kTkP71SRXHuT1Zb%2BVQUcQtsSmgsxw1hMnbr%2BDgaj1UGmd6Auwk20v2WuR%2Fh5ccFx5TDUpBVZmY6fS%2B9xJR5YD32FYxIchnslOOL65D0fmYA500%2FqMtrMf5LpBlxzo2YiGO%2Bz5VB4ZzaD3vFbrjjPM1GbVAoJFJwdn94tvxZX232WprO0DTJyaNutwn89ymFK%2FYjr%2FWEXfoF17daLvjUcTGojLqt6jNZMUt4Np7cSJJR1Hw%2FJ69PxaPfVv1%2BjPBc1b1LA6L8vNqt2nmNBO1Ibxwl1n66pk%2BnX%2BbhbazY%2B7O6ClRCxdQoxXoHB%2BLR6nxxIEaG5qt%2F9en5MYeHH6%2FJZI1giBdfyuE%2FaYSal9K9qtrE%2FYuhcm5FpGMYf0%2F1PmtgLPKK%2FAVfwnSeNlH8oSrEABvTrjDT%2BOUXSW1l%2B75OivqtNPLakRnCT%2FZolQpOWNElxv9Ve2AWm8jRQfxVXy2QA%2FFxE8j%2FaaKdW0tyuHD1914i6vtVYxFCONnC7uKahiDx0wZ%2BqLPEjH4r2joVg71Zi1ixrPlLYA2gcAWs8HwwGerYJi6iwR7LNtfbtBjlthmpNa8nmX1zBFSAJu66ZQDxg57yYnpbezQA0R%2FoZd2ZEVL7ITjd8qc7P0WEyn%2FS9Aj0LwlTVwoBjK%2FG7syRdt5krW6QgOwg%3D%3D'",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 80,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:22:00.742486Z",
      "duration_ms": null
    },
    {
      "url": null,
      "uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
      "input": null,
      "dst_ip": "172.18.0.2",
      "sensor": "hp-use-01",
      "shasum": null,
      "src_ip": "14.255.187.76",
      "eventid": "cowrie.session.closed",
      "message": "Connection lost after 21558 milliseconds",
      "outfile": null,
      "session": "2096f046bc95",
      "version": null,
      "dst_port": 2222,
      "password": null,
      "protocol": "ssh",
      "src_port": 57881,
      "username": null,
      "timestamp": "2026-09-14T09:22:02.558355Z",
      "duration_ms": 21558
    }
  ],
  "sensor": "hp-use-01",
  "source": "cowrie",
  "src_ip": "14.255.187.76",
  "session_id": "2096f046bc95"
}