Alert queue
Connecting…
| Severity | Category | Source IP | Sensor | Reasoning | Received |
|---|---|---|---|---|---|
| S4 | successful_intrusion | 80.94.92.234 | hp-use-01 | The session shows a successful SSH login to the honeypot using root:1, which constitutes a foothold. Per the rubric, any successful login is at least severity 4 | |
| S4 | successful_intrusion | 83.143.112.7 | hp-use-01 | The session achieved a successful SSH login using admin/admin, which constitutes a foothold on the honeypot. Per the rubric, any successful login is at least se | |
| S4 | successful_intrusion | 79.60.41.86 | hp-use-01 | The session shows a successful SSH login using username 'admin' with no failed attempts recorded. Per rubric, any successful login constitutes a foothold even i | |
| S4 | successful_intrusion | 79.60.41.86 | hp-use-01 | The session shows a successful SSH login using weak default-style credentials (admin/123456). Per rubric, any successful login is at least a foothold, making th | |
| S4 | successful_intrusion | 121.224.5.228 | hp-use-01 | The session shows a successful SSH login to the honeypot using credentials root/ubuntu. Per the rubric, any successful login constitutes a foothold and maps to | |
| S4 | successful_intrusion | 77.239.124.208 | hp-use-01 | The session shows a successful SSH login to the Cowrie honeypot using username root, which constitutes a foothold. Per the rubric, any successful login is at le | |
| S4 | successful_intrusion | 77.239.124.40 | hp-use-01 | The session shows a successful SSH login to the honeypot using the root account, which constitutes a foothold. Per the rubric, any successful login is at least | |
| S4 | successful_intrusion | 203.189.196.168 | hp-use-01 | The session shows a successful SSH login using root/centos, which constitutes a foothold on the honeypot. Per the rubric, any successful login is at least sever | |
| S4 | successful_intrusion | 92.118.39.49 | hp-use-01 | A successful SSH login occurred using root/123, which establishes a foothold and meets severity 4 by rubric. Retrieved session commands show no post-login comma | |
| S4 | successful_intrusion | 92.118.39.49 | hp-use-01 | The session shows a successful SSH login to the honeypot using root/111111. Per rubric, any successful login is at least a foothold and maps to successful_intru | |
| S4 | successful_intrusion | 103.149.197.34 | hp-use-01 | The session shows a successful SSH login to the Cowrie honeypot using username root with password %USER%. Per rubric, any successful login constitutes a foothol | |
| S4 | successful_intrusion | 2.57.122.168 | hp-use-01 | A successful SSH login occurred using weak credentials (root/123), which constitutes a foothold on the honeypot. Tool output confirms there were no post-login c | |
| S4 | successful_intrusion | 2.57.122.168 | hp-use-01 | A successful SSH login occurred using root/111111, which establishes a foothold on the honeypot. Per rubric, any successful login is at least severity 4 and fal | |
| S4 | successful_intrusion | 192.42.116.15 | hp-use-01 | The session shows a successful SSH login using root/admin after one failed attempt, which constitutes a foothold on the honeypot. Per rubric, any successful log | |
| S4 | successful_intrusion | 160.250.128.93 | hp-use-01 | The session includes a successful SSH login using root/password after one failed attempt, which constitutes a foothold on the honeypot. Per the rubric, any succ | |
| S4 | successful_intrusion | 109.122.254.169 | hp-use-01 | The session shows a confirmed successful SSH login using username/password values that appear to be IP addresses, indicating automated credential abuse. Per rub | |
| S4 | successful_intrusion | 189.223.176.45 | hp-use-01 | The session shows a successful SSH login using root/admin after one failed attempt, which constitutes a foothold on the honeypot. Per rubric, any successful log | |
| S4 | successful_intrusion | 35.205.233.82 | hp-use-01 | A successful SSH login occurred using admin/admin, which establishes a foothold and meets the rubric for severity 4. Session command retrieval shows no post-log | |
| S4 | successful_intrusion | 101.96.203.141 | hp-use-01 | The session shows a successful SSH login to the honeypot using root/ubuntu. Per rubric, any successful login constitutes a foothold and maps to successful_intru | |
| S4 | successful_intrusion | 80.67.172.162 | hp-use-01 | The session includes a successful SSH login using root/admin after one failed attempt, which establishes a foothold on the honeypot. Per the rubric, any success | |
| S4 | successful_intrusion | 47.98.157.78 | hp-use-01 | The session shows a successful SSH login using root/password after one failed attempt, which constitutes a foothold on the honeypot. Per the rubric, any success | |
| S4 | successful_intrusion | 184.153.171.150 | hp-use-01 | The session includes a successful SSH login using credentials root/admin after one failed attempt. Per rubric, any successful login constitutes a foothold even | |
| S4 | successful_intrusion | 180.106.152.211 | hp-use-01 | The session shows a successful SSH login using root/admin after one failed attempt, which constitutes a foothold on the honeypot. Per the rubric, any successful | |
| S4 | successful_intrusion | 118.196.86.191 | hp-use-01 | A successful SSH login occurred using root/debian, which establishes a foothold on the honeypot. Per the rubric, any successful login is at least severity 4 and | |
| S4 | successful_intrusion | 103.172.78.123 | hp-use-01 | A successful SSH login occurred using root/ubuntu, which establishes a foothold on the honeypot. No post-login commands, downloads, or uploads were observed, so |