195.178.110.227
- Sensor
- hp-use-01
- Source
- cowrie
- Status
- triaged
- Event time
- Received
Verdict
S4successful_intrusionConfidence 97%Escalate: yesReasoning
The session achieved a successful SSH login using root/1234, which constitutes a foothold on the honeypot. Tool output confirms there were no post-login commands or payload transfers, so this is not malware delivery or persistence. It is more than brute force because authentication succeeded, but attacker activity ended immediately after login.
Recommended action
Escalate as a confirmed successful intrusion; review source IP for blocking/watchlisting and correlate for repeated successful logins using weak credentials.
Routing
- Primary model
- gpt-4o-mini
- Final model
- gpt-5.4
- Escalated to strong model
- yes
- Prompt version
- triage-v4
- Input tokens
- 4,647
- Output tokens
- 258
- Cost
- $0.005904
- Latency
- 7,505 ms
- Verdict at
- 2026-11-09 10:11:12Z
Tool trace
0. get_session_commands· 0 ms
Arguments{ "session_id": "e3cd8fb15ff5" }Result{ "commands": [], "downloads": [], "session_id": "e3cd8fb15ff5", "command_count": 0, "download_count": 0, "clipped_commands": 0, "commands_truncated": false, "downloads_truncated": false }
Raw session JSON
{
"events": [
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.session.connect",
"message": "New connection: 195.178.110.227:53090 (172.18.0.2:2222) [session: e3cd8fb15ff5]",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 53090,
"username": null,
"timestamp": "2026-11-09T10:10:53.320297Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.version",
"message": "Remote SSH version: SSH-2.0-Go",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": "SSH-2.0-Go",
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 53090,
"username": null,
"timestamp": "2026-11-09T10:10:53.624184Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"encCS": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
"chacha20-poly1305@openssh.com",
"arcfour256",
"arcfour128",
"arcfour",
"3des-cbc",
"aes128-cbc"
],
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"input": null,
"macCS": [
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-sha1",
"hmac-sha1-96"
],
"compCS": [
"none"
],
"dst_ip": "172.18.0.2",
"langCS": [
""
],
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.kex",
"kexAlgs": [
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group16-sha512",
"diffie-hellman-group14-sha256",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
"ext-info-c",
"kex-strict-c-v00@openssh.com"
],
"keyAlgs": [
"ssh-rsa",
"rsa-sha2-256",
"rsa-sha2-512",
"ssh-dss",
"ecdsa-sha2-nistp256",
"ecdsa-sha2-nistp384",
"ecdsa-sha2-nistp521",
"ssh-ed25519"
],
"message": "SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 53090,
"username": null,
"timestamp": "2026-11-09T10:10:53.624643Z",
"duration_ms": null,
"hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none"
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.login.success",
"message": "login attempt [root/1234] succeeded",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": null,
"dst_port": 2222,
"password": "1234",
"protocol": "ssh",
"src_port": 53090,
"username": "root",
"timestamp": "2026-11-09T10:10:55.823352Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"width": 240,
"dst_ip": "172.18.0.2",
"height": 24,
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.client.size",
"message": "Terminal Size: 240 24",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 53090,
"username": null,
"timestamp": "2026-11-09T10:10:56.803346Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.227",
"eventid": "cowrie.session.closed",
"message": "Connection lost after 18153 milliseconds",
"outfile": null,
"session": "e3cd8fb15ff5",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 53090,
"username": null,
"timestamp": "2026-11-09T10:11:11.473167Z",
"duration_ms": 18153
}
],
"sensor": "hp-use-01",
"source": "cowrie",
"src_ip": "195.178.110.227",
"session_id": "e3cd8fb15ff5"
}