195.178.110.228
- Sensor
- hp-use-01
- Source
- cowrie
- Status
- triaged
- Event time
- Received
Verdict
S4successful_intrusionConfidence 98%Escalate: yesReasoning
The session shows a successful SSH login to the Cowrie honeypot using root/123123. Per rubric, any successful login is a foothold and maps to severity 4 with category successful_intrusion unless there is evidence of malware delivery or persistence. Retrieved session commands show none were executed, and there were no downloads or uploads, so there is no basis to raise severity to 5 or change category.
Recommended action
Escalate as a confirmed honeypot compromise attempt; retain session artifacts, block or monitor the source IP as appropriate, and watch for related login attempts against other assets.
Routing
- Primary model
- gpt-4o-mini
- Final model
- gpt-5.4
- Escalated to strong model
- yes
- Prompt version
- triage-v4
- Input tokens
- 4,654
- Output tokens
- 289
- Cost
- $0.006306
- Latency
- 7,690 ms
- Verdict at
- 2026-11-10 17:32:27Z
Tool trace
0. get_session_commands· 0 ms
Arguments{ "session_id": "8ec6b09a3c00" }Result{ "commands": [], "downloads": [], "session_id": "8ec6b09a3c00", "command_count": 0, "download_count": 0, "clipped_commands": 0, "commands_truncated": false, "downloads_truncated": false }
Raw session JSON
{
"events": [
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.session.connect",
"message": "New connection: 195.178.110.228:46678 (172.18.0.2:2222) [session: 8ec6b09a3c00]",
"outfile": null,
"session": "8ec6b09a3c00",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 46678,
"username": null,
"timestamp": "2026-11-10T17:32:10.484276Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.client.version",
"message": "Remote SSH version: SSH-2.0-Go",
"outfile": null,
"session": "8ec6b09a3c00",
"version": "SSH-2.0-Go",
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 46678,
"username": null,
"timestamp": "2026-11-10T17:32:10.830266Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"encCS": [
"aes128-ctr",
"aes192-ctr",
"aes256-ctr",
"aes128-gcm@openssh.com",
"aes256-gcm@openssh.com",
"chacha20-poly1305@openssh.com",
"arcfour256",
"arcfour128",
"arcfour",
"3des-cbc",
"aes128-cbc"
],
"hassh": "2ec37a7cc8daf20b10e1ad6221061ca5",
"input": null,
"macCS": [
"hmac-sha2-256-etm@openssh.com",
"hmac-sha2-512-etm@openssh.com",
"hmac-sha2-256",
"hmac-sha2-512",
"hmac-sha1",
"hmac-sha1-96"
],
"compCS": [
"none"
],
"dst_ip": "172.18.0.2",
"langCS": [
""
],
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.client.kex",
"kexAlgs": [
"curve25519-sha256@libssh.org",
"ecdh-sha2-nistp256",
"ecdh-sha2-nistp384",
"ecdh-sha2-nistp521",
"diffie-hellman-group-exchange-sha256",
"diffie-hellman-group-exchange-sha1",
"diffie-hellman-group16-sha512",
"diffie-hellman-group14-sha256",
"diffie-hellman-group14-sha1",
"diffie-hellman-group1-sha1",
"ext-info-c",
"kex-strict-c-v00@openssh.com"
],
"keyAlgs": [
"ssh-rsa",
"rsa-sha2-256",
"rsa-sha2-512",
"ssh-dss",
"ecdsa-sha2-nistp256",
"ecdsa-sha2-nistp384",
"ecdsa-sha2-nistp521",
"ssh-ed25519"
],
"message": "SSH client hassh fingerprint: 2ec37a7cc8daf20b10e1ad6221061ca5",
"outfile": null,
"session": "8ec6b09a3c00",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 46678,
"username": null,
"timestamp": "2026-11-10T17:32:10.830764Z",
"duration_ms": null,
"hasshAlgorithms": "curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group16-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c,kex-strict-c-v00@openssh.com;aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,arcfour256,arcfour128,arcfour,3des-cbc,aes128-cbc;hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96;none"
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.login.success",
"message": "login attempt [root/123123] succeeded",
"outfile": null,
"session": "8ec6b09a3c00",
"version": null,
"dst_port": 2222,
"password": "123123",
"protocol": "ssh",
"src_port": 46678,
"username": "root",
"timestamp": "2026-11-10T17:32:11.836207Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"width": 240,
"dst_ip": "172.18.0.2",
"height": 24,
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.client.size",
"message": "Terminal Size: 240 24",
"outfile": null,
"session": "8ec6b09a3c00",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 46678,
"username": null,
"timestamp": "2026-11-10T17:32:12.081602Z",
"duration_ms": null
},
{
"url": null,
"uuid": "28d6f35e-aed5-11f1-a29a-0242ac120002",
"input": null,
"dst_ip": "172.18.0.2",
"sensor": "hp-use-01",
"shasum": null,
"src_ip": "195.178.110.228",
"eventid": "cowrie.session.closed",
"message": "Connection lost after 16475 milliseconds",
"outfile": null,
"session": "8ec6b09a3c00",
"version": null,
"dst_port": 2222,
"password": null,
"protocol": "ssh",
"src_port": 46678,
"username": null,
"timestamp": "2026-11-10T17:32:26.959289Z",
"duration_ms": 16475
}
],
"sensor": "hp-use-01",
"source": "cowrie",
"src_ip": "195.178.110.228",
"session_id": "8ec6b09a3c00"
}